Method and system for scoring quality of traffic to network sites

ABSTRACT

A software and/or hardware facility for scoring the quality of traffic to a site accessible via the Internet or other network. The facility extracts data from one or more data logs that are obtained from a publisher, advertiser, or third party. A multi-factor analysis in the form of a rule set is applied by the facility to the data. The analysis of the data identifies agent actions that are desirable to a publisher, advertiser, or third party. The facility generates a relative score for each agent action. The score may be used to assess the quality of traffic received by a network site. Lower scores are indicative of traffic having little value, whereas higher scores are indicative of traffic having greater value. The score may be provided to an advertising network and used to charge a variable amount for advertisements based on the quality of traffic that the advertisements receive.

CROSS-REFERENCES TO RELATED APPLICATIONS

This application is a continuation of U.S. application Ser. No.17/483,526, entitled “METHOD AND SYSTEM FOR SCORING QUALITY OF TRAFFICTO NETWORK SITES” and filed Sep. 23, 2021, which is a continuation ofU.S. application Ser. No. 16/791,388, filed Feb. 14, 2020, which is acontinuation of U.S. application Ser. No. 11/567,718, filed Dec. 6,2006, which claims priority to and incorporates by reference in itsentirety, U.S. Provisional Application No. 60/742,860 filed on Dec. 6,2005. Each of these foregoing applications are hereby incorporatedherein in their entirety.

TECHNICAL FIELD

The disclosed technology relates to assessing the value of trafficassociated with network sites.

BACKGROUND

An increasing number of companies, agencies, individuals, and otherparties (collectively “advertisers”) use online advertising to advertiseto users of Internet or other network sites or services. An advertiserpurchases advertising space from an individual publisher or from anadvertising network that distributes advertisements to one or morepublishers. A publisher or advertising network may charge the advertiserusing one of several methods, including cost-per-click andcost-per-impression. In a cost-per-click system, an advertiser ischarged based on the number of times that agents click on itsadvertisement. An advertiser is not charged when a publisher displays anadvertisement to an agent unless the agent clicks on the advertisement.In a cost-per-impression system, an advertiser is charged based on thenumber of times a publisher displays its advertisement to an agent.

Click fraud, or fraudulent clicks on advertisements, is an issue thatconcerns advertisers and publishers who use cost-per-click and otherpayment models. Similarly, impression fraud, or displays ofadvertisements in situations where the advertisements will not make animpression on a human user, is an issue that concerns advertisers andpublishers who use cost-per-impression and other payment models. Clickor impression fraud can take a number of forms, including clicks on anadvertisement by or displays of an advertisement to competitors, webrobots, or users with personal or political agendas. In addition, anadware or clickware virus may install itself on a computer and generateclicks on or impressions of advertisements without the computer user'sknowledge. Fraudulent clicks or impressions do not generate revenue orother value for an advertiser; however, the advertiser must pay for theclicks or impressions. Click or impression fraud therefore harms theadvertiser by increasing advertising expense, and at the same time harmsthe publisher by lowering the perceived value of traffic the advertiserreceives from the publisher.

In an effort to alleviate the problem of click or impression fraud,there have been attempts to create systems that detect click orimpression fraud. Most click or impression fraud detection systemsclassify each click or impression in a binary manner as either “good” or“bad.” Publishers may use the results of click or impression frauddetection systems in a number of ways. In some cases, a publisher maysubtract bad clicks or impressions from the total number of clicks orimpressions, charging an advertiser for only good clicks or impressions.Binary click or impression fraud detection systems, however, haveseveral drawbacks. A click or impression may not fall neatly into eitherthe good or bad category, or it may be impossible to determine from thedata set that represents the click or impression whether in fact theclick or impression is good or bad. A binary approach will thereforeunfairly characterize those clicks or impressions that fall somewhere inbetween. In addition, advertisers may have differing thresholds as tothe type of traffic they are willing to accept. One advertiser mayconsider a user simply viewing its web site as a valuable transaction;another advertiser may only consider a purchase to be a valuabletransaction. A binary system does not allow an advertiser to set a levelthat determines the quality of traffic for which it is willing to paythe publisher. Advertisers and publishers alike would therefore benefitfrom having a more accurate system of click or impression frauddetection in order to better assess the value of traffic to publishersites.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram of a representative facility for scoring thequality of network traffic and an environment in which the facilityoperates.

FIG. 2 is a flow diagram of a method of computing the quality of networktraffic.

FIG. 3 is a flow diagram of a method of computing a correlation betweena rule set that is used to assess the quality of traffic and a desiredagent action.

FIG. 4 is a block diagram of a data structure used to compute thecorrelation between each rule in the rule set used to assess the qualityof traffic to a network site and a desired agent action.

FIG. 5 is a flow diagram of a method of scoring an agent action based ona rule set.

DETAILED DESCRIPTION

A software and/or hardware facility for scoring the quality of trafficto a site accessible via the Internet or other network is described. Thefacility extracts session data, or information identifying an agent'sinteractions with a server, from one or more server logs or other datasources that are obtained from a publisher, advertiser, or third party.In addition, the facility may obtain supplemental data from externaldata sources that assists in interpreting the agent's interactions withthe server. A multi-factor analysis in the form of a rule set is appliedby the facility to the session data. The analysis of the session dataidentifies agent actions that are desirable to a publisher, advertiser,or third party. Agent actions that are desirable to a publisher,advertiser, or third party include any activity that generates value forthe publisher, advertiser, or third party, such as a click, a conversion(e.g., purchase), a submission of a form, bookmarking of the site, arollover event, an impression, or other activity by the user. Thefacility generates a relative score for each agent action or for anaggregate number of agent actions based on whether the agent action isdesired by the publisher, advertiser, or third party. The score may beused to assess the quality of the traffic received by a network site.Lower scores are indicative of fraudulent, likely fraudulent, orotherwise non-productive traffic having little value, whereas higherscores are indicative of traffic having desirable characteristics andtherefore greater value.

In some embodiments, the score generated by the facility may be providedto the publisher or advertising network that published an advertisement.The publisher or advertising network may use the score for a number ofpurposes. For example, a publisher or advertising network may elect touse a pricing method that charges an advertiser a variable amount basedon the score of the traffic an advertisement receives. The publisher oradvertising network may decide not to charge for traffic that fallsbelow a certain threshold. For example, certain sites desiring to marketthe high value of their traffic may elect to charge only for traffichaving a score reflective of a low likelihood of fraud. In addition, apublisher or advertising network that receives a score on a real-timebasis may decide not to display advertisements to agents that have ascore indicating that the agent poses a high risk of fraud.

In some embodiments, the rule set used by the facility to generate thescore may be manually determined. Rules used to determine thedesirability of an agent action may include the physical location of theagent, the agent's browsing habits, search terms entered by the agent,rates charged to the advertiser for each agent action, the networktopology from which the agent originated, and other characteristics.Rules may also be automatically determined by the facility based on thecorrelation between a trait of a given agent, advertiser, publisher, orother feature, and a measurement of the resulting fraudulent trafficassociated with that trait. Different rule sets may be generated thatare optimized for different environments Within each rule set, each rulemay be weighted differently to generate an optimum combination of rulesto comprise the rule set, and rules may be selectively removed if theydo not perform well in an environment.

The following description provides specific details for a thoroughunderstanding of, and enabling description for, various embodiments ofthe technology. One skilled in the art will understand that thetechnology may be practiced without these details. In some instances,well-known structures and functions have not been shown or described indetail to avoid unnecessarily obscuring the description of theembodiments of the technology. It is intended that the terminology usedin the description presented below be interpreted in its broadestreasonable manner, even though it is being used in conjunction with adetailed description of certain embodiments of the technology. Althoughcertain terms may be emphasized below, any terminology intended to beinterpreted in any restricted manner will be overtly and specificallydefined as such in this Detailed Description section.

I. Overview

FIG. 1 is a block diagram illustrating the components of a trafficscoring facility 100 and a representative environment in which thetraffic scoring facility operates. The traffic scoring facility 100extracts data from publishers, advertisers, agents, and/or other partiesto generate a relative score of the quality of traffic received by asite accessible by a network (hereinafter “a publisher site”). Thegenerated score relates to the value of the traffic to that site ascharacterized by one or more parties associated with the site. Forexample, the publisher site may be a site that displays onlineadvertisements, and the desired agent on that site may be a human userthat would benefit from viewing advertisements, rather than robotictraffic or human users with fraudulent intent. The score generated bythe facility would thereby relate to the likelihood that the agent was ahuman user with non-fraudulent intent.

The publisher site includes a publisher server 105 and a server log 125.The publisher server 105 serves one or more pages 120 containing contentto an agent that interacts with the site. An agent is any human,software entity, or device that interacts with the site, including, butnot limited to, a human user, a human user with fraudulent intent, arobot, spyware, an adware or clickware virus, or improperly operatingsoftware. The server log 125 stores session data associated with theagent's interactions with the publisher server 105. The publisher site105 may be any type of site accessible via a network such as a searchengine site, a directory site, a news or other content site, a socialnetworking site, a photo sharing or other service site, or any otheronline property.

A publisher site will typically include or utilize the services of anadvertising service 165 to populate the publisher page 120 that itproduces with one or more advertisements. An advertiser 180 may purchaseadvertising placements on a publisher site in a variety of ways. Forexample, the advertiser may purchase keywords from the advertisingservice 165 that are relevant to the products and/or services that theadvertiser offers. In the depicted environment, the advertising service165 generates a list 122 of advertisements. The list may be generated bymatching the keywords of a search query or a content page toadvertiser-keyword pairings in its advertising database 170. The list122 of advertisements generated by the advertising service 165 may bedisplayed on the publisher page 120, often above or alongside contentprovided by the publisher site.

When an agent takes an action associated with an advertisement displayedon a publisher page 120, the agent is directed to an advertiser site135. Once at the advertiser site, the agent may interact with the site,such as by viewing content, purchasing products or services, and otheractivities. As the agent interacts with the advertiser site, dataidentifying an agent's actions is stored in a server log 140. As will bedescribed herein, the data in the server log may be utilized tocharacterize the value of the agent's interaction with the advertisersite.

When an agent is displayed an advertisement, a record of the agentaction is maintained by the advertising service 165 and the advertisermay be charged for the agent action. For example, if the advertisingservice relies on a cost-per-click model, the advertiser will be chargedfor an agent click on an advertisement. If the advertising servicerelies on an impression model, the advertiser will be charged for eachtime an advertisement is displayed to an agent. On a periodic basis, abilling component 175 may deduct an amount from an advertiser's accountequal to the number of agent actions multiplied by the value theadvertiser has agreed to pay for each agent action. Those skilled in theart will appreciate that various limits may be set by the advertiser onthe amount of its advertising spending, such as setting a maximum amountto be paid for each agent action or an aggregate amount to be paidwithin a certain time period.

In the majority of cases, traffic to the publisher server 105 over anetwork 130 (such as the Internet) is of value to the publisher and toadvertisers that advertise on the publisher site. For example, humanusers 145 may interact with the publisher server 105 and take actionassociated with advertisements in which they have an interest, leadingto the possibility of monetary or other gain for advertisers.Unfortunately, a portion of the traffic to the publisher server 105 maycome from sources that are not valuable to the publisher or advertisers.For example, robots 150 may arrive at a publisher site and click onadvertisements in search of email addresses or other data. Such robotictraffic increases the load on the publisher site, while at the same timefails to generate valuable traffic for advertisers. Other traffic 155with fraudulent intentions can also reach the publisher site. Forexample, individuals may click on or cause the display of advertisementsof competitors, those with personal or political agendas contrary totheir own, and others, all of which may intend to exhaust theadvertising budget of the advertiser. Fraudulent traffic 155 does notgenerate valuable traffic for an advertiser and may also be of littlevalue to the publisher.

In order to reduce the effect of fraudulent traffic on advertisers andpublishers, a traffic scoring facility 100 may be operated by, orprovided as a service to, publishers or advertisers. Data from serverlogs or other sources may be submitted to the traffic scoring facility100. Data may also be submitted directly from the publisher server 105to the traffic scoring facility 100 in real time. As will be describedin additional detail herein, the traffic scoring facility applies one ormore rule sets stored in data store 160 to the received data to generatea score that, on a per agent action or on an aggregate agent actionbasis, characterizes the traffic. The score reflects the anticipatedvalue of the traffic, i.e., “good” traffic that is likely to be of valuewill receive a higher score and “bad” traffic that is likely to be oflittle value will receive a lower score.

Once a score has been computed for an individual agent action or for agroup of agent actions, the traffic scoring facility 100 may provide thescore to the billing component 175 of the advertising service. Theadvertising service may utilize the score in a variety of ways. Forexample, the advertising service may elect to use a pricing method thatcharges an advertiser 180 a variable amount based on the score of thetraffic its advertisement receives. Traffic having a higher score may becharged to the advertiser at a higher rate, while traffic having a lowerscore may be charged to the advertiser at a lower rate. Alternatively, apublisher may agree not to charge an advertiser for traffic that doesnot exceed a certain score. In this manner, an advertiser has greatercontrol over the quality of traffic to which it advertises. In addition,an advertiser may determine whether to continue using an advertisingservice 165 or a particular publisher based on the quality of traffic itreceives. Based on the score of the traffic it receives, an advertisermay also decide to make adjustments to the keywords it purchases fromthe advertising service 165 or to its methodology for placingadvertisements. In addition, an advertiser or publisher may use thescore to assess the damage or loss of revenue resulting from low qualitytraffic.

As discussed above, the traffic scoring facility 100 utilizes one ormore rule sets stored in data store 160 to rate the quality of traffican advertisement receives. In a training phase, the facility analyzestraffic in one or more environments and selects an optimum set of rules(an “environment rule set”) that may be used to score traffic withineach environment. In a scoring phase, an environment rule set is appliedto traffic from an environment to score traffic in that environment.Each of these phases will be discussed in detail below.

II. Training Phase

FIG. 2 is a flow chart of a process 182 for generating and validatingrule sets that may be used to assess the value of traffic in variousenvironments. At a block 184, a global rule set is generated. Each rulein the global rule set is an expression that receives as input one ormore parameters associated with an agent's session. When the rule isapplied by the facility to the input parameters, it produces a resultthat reflects the value of an agent's actions associated with thatagent's session. Rules may measure agent activities, including the speedwith which an agent clicks on an advertisement (i.e., velocity), thetime an agent spends on an advertiser's site, or the length or number ofkeywords an agent enters as search terms. Rules may also measure othercharacteristics of the agent. For example, one rule may score IPaddresses and maintain a “blacklist” of IP addresses that generate lowquality traffic. The blacklist may contain IP addresses, scoresgenerated by traffic originating from those IP addresses, and otherdetails. The facility may evaluate an IP address associated with a newagent by referencing the blacklist. Agents having IP addresses on theblacklist may be scored appropriately, and agents having an IP addressin close proximity to IP addresses on the blacklist may be scored basedon a function of the numerical distance between the agent's IP addressand blacklisted IP addresses. Rules may also measure publisher andadvertiser characteristics, including where a publisher resides withinan advertising network hierarchy or the amount of money an advertiser ischarged for each agent action associated with an advertisement. Asophisticated rule related to a publisher distribution partner maymeasure whether more than a certain percentage (e.g., >80%) of the IPaddresses associated with the publisher have multiple user agentsassociated with those IP addresses as measured on the day that a clickfrom that distribution partner was received. Such a characteristic isoften indicative of traffic with little or no value to an advertiser.

Each rule in the rule set may be phrased in a manner that allows therule to be applied and the result to be expressed in binary form (i.e.,“1” if the rule is satisfied or “0” if the rule is not satisfied). Forexample, a rule may be defined as a physical location of an agent, witha result of “1” if the physical location of the agent is in the UnitedStates and a result of “0” if the physical location of the agent is notin the United States. Alternatively, the rule may be phrased in a mannersuch that the result may be expressed as having a value that varies from0 to N (e.g., when N equals four, the result may take a value of 0, 1,2, 3, or 4).

The global rule set may be generated in a variety of ways. For example,the global rule set may be manually selected by an operator of thetraffic scoring facility based on observed patterns of fraudulenttraffic. The facility may also automatically generate rules as itidentifies environment features that correlate with fraudulent traffic.The total number of rules in the global rule set may range from the tensto the hundreds or more. The global rule set is not static; rather, itcan be supplemented and modified over time. Ineffective rules may beremoved from the global rule set, just as new rules may be added as theyare generated or found beneficial.

Once a global rule set has been generated, at a block 186 the facilityselects a traffic data set representative of traffic in a particularenvironment. An environment may be any site, resource, or service havingtraffic that shares similar characteristics. For example, an environmentmay be a search web site that displays advertisements in conjunctionwith search results, an ecommerce web site that sells the products of anadvertiser, or a content provider that offers a variety of services forothers. The traffic data set may be represented in the form of a serverlog, log file, or other data format that allows various parametersassociated with the traffic to be evaluated. In the event that actualtraffic is not available, a training set of data that is believed to bereflective of the actual data may be used. Alternatively, a defaulttraining set of data may be used if no other agent action data isavailable.

At a block 188 the facility analyzes the global rule set to assess theability of each rule in the global rule set to predict the likelihood ofvaluable traffic in the selected environment. That is, a determinationis made as to the likelihood that a desired agent action will occur foreach result permutation when a rule is applied to traffic associatedwith the environment. FIG. 3 is a flow chart of a process 200 that isimplemented by the traffic scoring facility 100 to determine thecorrelation between each rule in the global rule set and a desired agentaction. As part of the analysis, the facility may rely on one or moreserver logs or other data sources created and maintained by anadvertiser or publisher, as well as one or more sources of external dataprovided by third parties that may be used to further characterize orenhance the content in the server log. At a block 205, the trafficscoring facility 100 receives a server log, which may be an advertiserserver log 140 or a publisher server log 135. At a decision block 208,the facility determines whether there are other related server logs thatmay be used in the analysis. If other server logs exist, at a block 210the related server log or logs are retrieved and reconciled with thefirst server log. At a decision block 215, the traffic scoring facilitydetermines whether there is supplemental external data that may assistin interpreting a server log. Supplemental external data may includeinformation from an advertiser about whether a conversion (e.g.,purchase) or other desired agent action occurred, information from apublisher such as statistical information on advertisement performance,information relating to a geographical mapping of an IP address, andother types of information. If there is supplemental external data, theprocessing proceeds to a block 220 where the external data is retrieved.

Once the server log and any supplemental external data are retrieved,the facility proceeds to a block 235 where the server log is enhancedwith the supplemental external data. For example, a server log retrievedfrom a publisher may not contain information about whether a conversionoccurred, because a conversion occurs after an agent is transferred fromthe publisher site to an advertiser site. This data may only beavailable from an advertiser. In order to utilize the server log data todetermine whether a correlation exists between a session and aconversion, data from the server log may be enhanced by data retrievedfrom the advertiser about whether a conversion occurred. As anotherexample, in cases where the IP address associated with a particularagent is known, the IP address may be correlated with a geographicaldatabase to determine the rough geographical area from which the agentis accessing the site. Many types of supplemental external data can beused to enhance the data received from a server log.

At a block 245, the facility chooses a single session from the serverlog data, as enhanced by the supplemental external data. A session maybe defined as one or more entries in the server log or other data sourceindicative of an agent's interaction with a network site. A session maycontain no clicks, one click, or multiple clicks that occur as an agentinteracts with the network site, and a session may span one or morevisits to the network site within a period of time (e.g., within anhour, within 24 hours). Those skilled in the art will appreciate that itcan be difficult to identify a single agent session for many reasons,including that agents often share an IP address or a session identifier,a unique agent may have an IP address that changes, and other reasons.To identify a single agent session, the facility may therefore apply oneor more algorithms. Under a simple agent ID algorithm, an agent may beidentified by the first three bytes of its IP address in combinationwith the User Agent ID identified by the server log. Under an advancedagent ID algorithm, an agent may be identified by a combination of theUser Agent ID identified by the server log, the last two parts of thedomain name associated with the IP address (or the first two bytes ofthe IP address if no domain name can be found), and, if there are two ormore agent actions, the elapsed time between the agent actions. Byparsing a server log to identify all entries in the sever log thatsatisfy the algorithm, the facility is able to generate a subset ofactions within the server log that may be associated with the particularagent.

Once a single session of an agent is selected, at a block 250 thefacility ascertains whether the session resulted in a desired agentaction. A desired agent action is an action taken by an agent thatgenerates value for the advertiser, such as monetary or other gain.Desired agent actions may be defined by the party generating the trafficscore or by the party that will be receiving the traffic score. Forexample, if the desired action to be taken by a agent is the purchase ofa product or service, a desired agent action may be defined as payingfor the product or service. As another example, if the desired action tobe taken by an agent is the viewing of a particular media clip, adesired agent action may be defined as the downloading of media contentto an agent during a session. As still another example, a desired agentaction may be a click on an advertisement that is displayed to theagent. A desired agent action may be globally recognized as beneficialby a large group of parties (e.g., the purchase of a product from aretailer or a human user), or more narrowly recognized as beneficial toa single party (e.g., the viewing of a trailer for a new movie at thesite of the movie studio that is producing the movie).

For each rule in the global rule set, at a block 260 the facilityapplies the rule to the data associated with a single session anddetermines the result, e.g., “0” or “1” in the binary example describedabove. At a block 265, the facility stores the results in a table. FIG.4 is a block diagram of a representative table 300 in which the resultsmay be stored. Each row 310 a, 310 b, . . . 310 n in the tablecorresponds to one rule in the global rule set (i.e., from rule₁ torulen)—The first four columns in the table are used to record the resultas each rule is applied to the session data. Columns 315 a and 315 bcorrespond to sessions that resulted in desired agent actions. Column315 a reflects desired agent actions that occur when the result of therule is “0” (i.e., the rule was not satisfied). Column 315 b reflectsdesired agent actions that occur when the result of the rule is “1”(i.e., the rule was satisfied). A count is maintained in each column,and is incremented to reflect a result that falls within that column.Columns 320 a and 320 b correspond to sessions that did not result indesired agent actions. Column 320 a reflects sessions where a desiredagent action does not occur and the result of the rule is “0” (i.e., therule was not satisfied). Column 320 b reflects sessions where a desiredagent action does not occur and the result of the rule is “1” (i.e., therule was satisfied). Each time a session is analyzed, the count within acolumn is incremented to reflect the result. For example, FIG. 4 showsthe results of rule1 for 10,000 agent sessions stored in row 310 a.While only four columns are depicted in table 300 to reflect the resultsof applying a rule, those skilled in the art will appreciate that thenumber of columns may be any number that reflects the number ofpotential results for a rule. For example, a rule with three results(“0,” “1,” or “2”) may require six columns—three devoted to the sessionsthat result in desired agent actions, and three devoted to sessions thatdo not result in desired agent actions. While FIG. 4 depicts a tablewhose contents and organization are designed to make it morecomprehensible to the reader, those skilled in the art will appreciatethat the actual data structure used by the facility to store thisinformation may differ from the table shown. For example, the table maybe organized in a different manner, may contain more or less informationthan shown, may be compressed and/or encrypted, and may otherwise beoptimized in a variety of ways.

Returning to FIG. 3 , at a block 270 a test is made by the facility todetermine if there are any more rules in the global rule set to apply.If additional rules exist, processing loops to block 255 to process thenext rule in the list. If additional rules do not exist, processingcontinues to a decision block 275.

At a decision block 275, the facility determines if additional sessionsremain in the server log to be processed. If additional sessions existthat are to be processed, the facility returns to block 245 to selectthe next session in the log. The process defined by blocks 245 through270 is thereby repeated as many times as necessary to process thesession information of all agent sessions as reflected in the server logor other data log. If no additional sessions remain to be processed atblock 275, processing continues to a block 280.

In some embodiments, the rule set is applied only to those entries in aserver log that correspond to a click or impression. An entry in aserver log that corresponds to a click or impression may be referred toas an atomic session. In the embodiments described, each rule in therule set is applied only to each atomic session. This application of therule set is particularly advantageous in the case of scoring clicks onor impressions of advertisements.

Once all sessions have been processed, at a block 280, the facilitycalculates a correlation coefficient that is representative of thelikelihood that the session parameters tested by the rule will indicatea desired agent action. To calculate a correlation coefficient, analgorithm is applied to the session results stored in table 300. In someembodiments, a statistically significant number of agent actions musthave been measured that resulted in both sessions in which a rule wassatisfied and sessions in which a rule was not satisfied in order for acorrelation coefficient to be calculated. If there are fewer than acertain number of agent actions (e.g., 50) where the rule is satisfiedor, alternatively, fewer than a certain number of agent actions wherethe rule is not satisfied, the correlation coefficient is set to zero.In other words, if the rule is nearly always satisfied or neversatisfied, the rule may not be a good predictor of a desired agentaction in the selected environment. In some embodiments, for acorrelation coefficient to be calculated, a rule must result in astatistically significant number of both desired agent actions andnon-desired agent actions. If either all agent actions are valuable,alternatively, no agent actions are valuable, the correlation is set tozero. In other words, if a desired agent action either always occurs ornever occurs, the rule may not be a good predictor of a desired agentaction in the selected environment. If a sufficient number of agentactions are measured from both a rule satisfaction and a desired agentaction standpoint, then a correlation coefficient may be calculated forthat rule. The correlation coefficient may be calculated for each rulein accordance with the following equation (1):

${{coefficent}\left( {rule}_{x} \right)} = \frac{{{val\_ and}{\_ rule}{\_ satisfied}\left( {rule}_{x} \right)} - \left( {{{val}\left( {rule}_{x} \right)}{\bullet rule\_ satisfied}\left( {rule}_{x} \right)} \right)}{\sqrt{{{val}\left( {rule}_{x} \right)}{\bullet rule\_ satisfied}\left( {rule}_{x} \right){\bullet non\_ val}\left( {rule}_{x} \right){\bullet rule\_ not}{\_ satisfied}\left( {rule}_{x} \right)}}$where val and rule satisfied is the percentage of the total number ofagent actions in which a desired agent action occurs and the rule issatisfied (i.e., the percentage of agent actions that fall in column 315b); val is the percentage of the total number of agent actions in whicha desired agent action occurs (i.e., the percentage of agent actionsthat fall in either column 315 a or 315 b); rule_satisfied is thepercentage of the total number of agent actions in which the rule issatisfied (i.e., the percentage of agent actions that fall in eithercolumn 315 b or 320 b); non_val is the percentage of the total number ofagent actions in which a desired agent action does not occur (i.e., thepercentage of agent actions that fall in either column 320 a or 320 b);and rule_not_satisfied is the percentage of the total number of agentactions in which the rule is satisfied (i.e., the percentage of agentactions that fall in either column 315 a or 320 a). This correlationequation may be applied in circumstances when the result of the rule isbinary (i.e., “0” or “1”) and the occurrence of a desired user action isbinary (i.e., a user action either did or did not occur). In othercases, an appropriately modified or different correlation equation maybe used. The result of the correlation coefficient calculation for eachrule is stored in column 340 of table 300.

While a particular algorithm is disclosed for calculating thecorrelation coefficient, those skilled in the art will appreciate that avariety of different algorithms may be used to determine how well eachrule may predict that the traffic characterized by the rule isbeneficial (e.g., will result in a desired agent action) or harmful(e.g., is associated with fraudulent traffic). Correlation coefficientsmay be used rather than regression coefficients (computed throughlogistic regression) since correlation coefficients offer a more robustmethodology. That is, the logistic regression approach is a poor choicewhen the dependent variables are highly correlated. The correlationapproach described herein can be viewed as a ridge regression whereregression coefficients are constrained and must have the same sign asthe rule correlations.

After calculating the correlation coefficient, at a block 285 thefacility determines whether the correlation coefficient is statisticallysignificant for the selected environment. The facility makes thisdetermination by selecting only those rules that have a correlationcoefficient that is in excess of a certain percentage. For example, thefacility may keep only those rules that have a correlation coefficientin excess of 75% as part of a rule set that is associated with theenvironment (hereinafter, the “environment rule set”). If analysis ofthe correlation coefficient indicates that it is not statisticallysignificant for the selected environment, the rule may be omitted fromthe environment rule set. The final column 345 in the table 300 containsa flag for each rule that may be set to a value of “0” or “1.” Once thefacility has determined at a block 285 whether the correlationcoefficient is statistically significant, the result is stored in column345. If a rule has a statistically significant correlation, the ruleflag value in column 345 will be set to “1.” If the rule does not have astatistically significant correlation, the rule flag value in column 345will be set to “0.” Only those rules with a rule flag value of “1,”i.e., those that are statistically significant, will be used indetermining a score of traffic in the selected environment. Rules thatperform well for a particular environment are therefore maintained inthe rule set for that environment, whereas rules that do not performwell for a particular environment are discarded.

Returning to FIG. 2 , at a block 190 the environment rule set for theparticular environment, including the correlation coefficients for eachof the rules in the environment rule set, is stored by the facility sothat it may be used again without having to re-execute the processindicated by FIGS. 3 and 4 . After the environment rule set has beenstored, the facility proceeds to a block 192 to determine whether thereare any additional environments for which an environment rule set shouldbe generated. If there are additional environments, processing loops toblock 186 to process the next environment. Once the training phase iscomplete, the facility will have generated and stored a rule set foreach identified environment. In this way, a unique rule set may begenerated for each publisher, advertiser, or other characteristic, orany combination thereof. Each rule set will reflect the predictiveparameters of the traffic received by that environment.

III. Scoring Phase

Once a rule set has been determined for an environment in the trainingphase, future traffic to that environment may be scored using theenvironment rule set during a scoring phase. FIG. 5 is a flow diagramillustrating a process 500 of computing a score for a new agent actionassociated with an agent's interaction with a network site. At a block505, a traffic data set is received by the facility reflecting anagent's interaction with a particular environment. As discussed above,the traffic data set may take the form of a server log, log file, orother form of data that allows various parameters associated with thetraffic to be evaluated. As in the training phase, the received trafficdata set may be reconciled with any supplemental external data or anyother traffic data sets that are related to the received traffic dataset. At a block 510, the facility identifies the environment with whichthe traffic data set is associated. The environment may be identifiedbased on the publisher, advertiser, agent, and/or other feature of theenvironment. Once the environment has been identified, at a block 515,the stored environment rule set for the identified environment isselected by the facility. If no environment rule set is available forthe identified environment, or if the environment cannot be reliablyidentified by the facility, a default rule set may be used by thefacility.

Once an environment rule set or default rule set has been selected, at ablock 525 the facility applies the environment rule set to each sessionwithin the traffic data set to generate a session score. To generate thescore, the facility applies an algorithm that results in the summationof a function of the correlation coefficients over all rules in theenvironment rule set. The algorithm may be represented by the followingequation (2):

${score} = {\sum\limits_{j = 1}^{n}{{f\left( c_{j} \right)}r_{j}}}$where there are n rules in the environment rule set, f(cj) is thecorrelation coefficient for each rule in the rule set, and rj is theresult of the rule. The score calculated by equation (2) produces ascore that is relative to the value of the session; higher scoresindicate a more valuable agent action, whereas lower scores indicate aless valuable agent action. Calculating traffic scores in this fashionresults in a more refined estimate of traffic value that is of greaterbenefit to publishers and advertisers.

In equation (2), each of the rules in the rule set is weighted equally.In some embodiments, it may be desirable to weight some rules more orless than others if the rules are deemed better or worse, respectively,than others at predicting whether a desired agent action will occur. Insuch a case, each rule may be weighted differently, e.g., by multiplyingthe rule by a coefficient prior to performing the summation. A weightedalgorithm may be represented by the following equation (3):

${score} = {\sum\limits_{j = 1}^{n}{K_{j}{f\left( c_{j} \right)}r_{j}}}$where there are n rules in the environment rule set, Kj is the weightapplied to the rule, f(cj)is the correlation coefficient for each rule,and rj is the result of the rule. Each rule may be weighted by a valuechosen from a small set of pre-selected values and may be optimized fora particular environment.

Once a session score has been generated for each session within thetraffic data set, at a block 535 the facility may aggregate all sessionscores to generate a score for all or portions of the traffic data set.An aggregate score may therefore be calculated for all traffic receivedby a publisher or advertising network, or it may calculated for a morelimited environment defined by a single advertiser, publisher affiliate,or other group. In this manner, the quality of traffic may be determinedglobally for a publisher or advertiser network, or it may be determinedon a per publisher affiliate, advertiser, or other group basis.

Once a score has been calculated by the facility, either for a singlesession, a portion of the traffic data set, or a traffic data set as awhole, the score may optionally be normalized to place it into a formthat may be more readily understood and used by advertisers andpublishers. At a block 540 the facility optionally normalizes the scoreso that the score will fall within a standard range. For example, thescore may be normalized so that it always falls within a range from 300to 800. When normalized in this fashion, each incremental change in thescore may be more readily acted upon since the scale of the score hasgreater meaning. For example, a certain point change in a normalizedscore (e.g., a decrease of 50 points, as from 650 to 600) may correspondto a certain change in the proportion of agent actions that are valuableto an advertiser (e.g., the proportion of agent actions that arevaluable to an advertiser is reduced by 50%). The score may also beconverted into a non-numeric scale, such as an A+, A, B+, etc. scale,that may facilitate a greater understanding of and simplify the use ofthe score. By providing a gradated score for traffic, the facilitysignificantly improves the ability of publishers and advertisers to usethe score to assess the value of traffic.

Unless the context clearly requires otherwise, throughout thedescription and the claims, the words “comprise,” “comprising,” and thelike are to be construed in an inclusive sense, as opposed to anexclusive or exhaustive sense; that is to say, in the sense of“including, but not limited to.” As used herein, the terms “connected,”“coupled,” or any variant thereof, means any connection or coupling,either direct or indirect, between two or more elements; the coupling ofconnection between the elements can be physical, logical, or acombination thereof. Additionally, the words “herein,” “above,” “below,”and words of similar import, when used in this application, shall referto this application as a whole and not to any particular portions ofthis application. Where the context permits, words in the above DetailedDescription using the singular or plural number may also include theplural or singular number respectively. The word “or,” in reference to alist of two or more items, covers all of the following interpretationsof the word: any of the items in the list, all of the items in the list,and any combination of the items in the list.

The above detailed description of embodiments of the system is notintended to be exhaustive or to limit the system to the precise formdisclosed above. While specific embodiments of, and examples for, thesystem are described above for illustrative purposes, various equivalentmodifications are possible within the scope of the system, as thoseskilled in the relevant art will recognize. For example, while processesor blocks are presented in a given order, alternative embodiments mayperform routines having steps, or employ systems having blocks, in adifferent order, and some processes or blocks may be deleted, moved,added, subdivided, combined, and/or modified to provide alternative orsubcombinations. Each of these processes or blocks may be implemented ina variety of different ways. Also, while processes or blocks are attimes shown as being performed in series, these processes or blocks mayinstead be performed in parallel, or may be performed at differenttimes.

The teachings of the methods and system provided herein can be appliedto other systems, not necessarily the system described above. Theelements and operation of the various embodiments described above can becombined to provide further embodiments.

While certain aspects of the technology are presented below in certainclaim forms, the inventors contemplate the various aspects of thetechnology in any number of claim forms. For example, while only oneaspect of the invention is recited as embodied in a computer-readablemedium, other aspects may likewise be embodied in a computer-readablemedium. Accordingly, the inventors reserve the right to add additionalclaims after filing the application to pursue such additional claimforms for other aspects of the technology.

From the foregoing, it will be appreciated that specific embodiments ofthe invention have been described herein for purposes of illustration,but that various modifications may be made without deviating from thespirit and scope of the invention. Accordingly, the invention is notlimited except as by the appended claims.

The invention claimed is:
 1. A computer-implemented method comprising:identifying, by a computer system comprising one or more hardwareprocessors, a set of agent actions in a server log generated by acontent provider system in a network environment, wherein the set ofagent actions are associated with a content of a network site of thecontent provider system, and wherein each agent action of the set ofagent actions is associated with a combined identifier that includes:(i) an agent identifier of an agent that performed the agent action; and(ii) two or more parts of a domain name associated with the agentidentifier; processing, by the computer system, the set of agent actionsto generate a set of values, wherein the set of values represent anindication of quality of agent actions with the content presented on thenetwork site, and wherein processing the set of agent actions includes:measuring a velocity metric between at least two consecutive agentactions associated with the combined identifier; and determining anelapsed time during which the agent associated with the combinedidentifier interacted with the content of the network site; andgenerating, based on the set of values and by the computer system, anoutput identifying that one or more agent actions correspond to lowquality interactions with the content presented on the network site. 2.The computer-implemented method of claim 1, further comprisingdisregarding the one or more agent actions during subsequentnetwork-traffic evaluation of the content.
 3. The computer-implementedmethod of claim 1, wherein the content comprises one or more of anadvertisement or a keyword.
 4. The computer-implemented method of claim1, wherein the set of agent actions include clicks on the content; andwherein the set of values for the set of agent actions are used toassess a relative value of the content.
 5. The computer-implementedmethod of claim 1, wherein the set of agent actions include a desiredagent action, wherein the desired agent action comprises one or more ofan impression or a conversion.
 6. The computer-implemented method ofclaim 1, wherein the one or more agent actions corresponding to the lowquality interactions are performed by one or more of a bot, a spyware,an adware virus, a clickware virus, or an improperly operating softwareprogram.
 7. The computer-implemented method of claim 1, wherein the oneor more agent actions corresponding to the low quality interactions areidentified further based on a determination that the agent isidentifiable from a blacklist of network addresses.
 8. A systemcomprising: one or more processors; and a non-transitory computerreadable storage medium containing instructions which, when executed onthe one or more processors, cause the one or more processors to performone or more operations including: identifying a set of agent actions ina server log generated by a content provider system in a networkenvironment, wherein the set of agent actions are associated with acontent of a network site of the content provider system, and whereineach agent action of the set of agent actions is associated with acombined identifier that includes: (i) an agent identifier of an agentthat performed the agent action; and (ii) two or more parts of a domainname associated with the agent identifier; processing the set of agentactions to generate a set of values, wherein the set of values representan indication of quality of agent actions with the content presented onthe network site, and wherein processing the set of agent actionsincludes: measuring a velocity metric between at least two consecutiveagent actions associated with the combined identifier; and determiningan elapsed time during which the agent associated with the combinedidentifier interacted with the content of the network site; andgenerating, based on the set of values, an output identifying that oneor more agent actions correspond to low quality interactions with thecontent presented on the network site.
 9. The system of claim 8, whereinthe instructions further cause the one or more processors to perform oneor more operations including disregarding the one or more agent actionsduring subsequent network-traffic evaluation of the content.
 10. Thesystem of claim 8, wherein the content comprises one or more of anadvertisement or a keyword.
 11. The system of claim 8, wherein the setof agent actions include clicks on the content; and wherein the set ofvalues for the set of agent actions are used to assess a value of thecontent.
 12. The system of claim 8, wherein the set of agent actionsinclude a desired agent action, wherein the desired agent actioncomprises one or more of an impression or a conversion.
 13. The systemof claim 8, wherein the one or more agent actions corresponding to thelow quality interactions are performed by one or more of a bot, aspyware, an adware virus, a clickware virus, or an improperly operatingsoftware program.
 14. A computer-program product tangibly embodied in anon- transitory machine-readable storage medium, including instructionsconfigured to cause one or more processors of a computer system toperform one or more operations including: identifying a set of agentactions in a server log generated by a content provider system in anetwork environment, wherein the set of agent actions are associatedwith a content of a network site of the content provider system, andwherein each agent action of the set of agent actions is associated witha combined identifier that includes: (i) an agent identifier of an agentthat performed the agent action; and (ii) two or more parts of a domainname associated with the agent identifier; processing the set of agentactions to generate a set of values, wherein the set of values representan indication of quality of agent actions with the content presented onthe network site, and wherein processing the set of agent actionsincludes: measuring a velocity metric between at least two consecutiveagent actions associated with the combined identifier; and determiningan elapsed time during which the agent associated with the combinedidentifier interacted with the content of the network site; andgenerating, based on the set of values, an output identifying one ormore agent actions correspond to low quality interactions with thecontent presented on the network site.
 15. The computer-program productof claim 14, wherein the instructions further cause the one or moreprocessors to perform one or more operations including disregarding theone or more agent actions during subsequent network-traffic evaluationof the content.
 16. The computer-program product of claim 14, whereinthe content comprises one or more of an advertisement or a keyword. 17.The computer-program product of claim 14, wherein the set of agentactions include clicks on the content; and wherein the set of values forthe set of agent actions are used to assess a value of the content. 18.The computer-program product of claim 14, wherein the set of agentactions include a desired agent action, wherein the desired agent actioncomprises one or more of an impression or a conversion.
 19. Thecomputer-program product of claim 14, wherein the one or more agentactions corresponding to the low quality interactions are performed byone or more of a bot, a spyware, an adware virus, a clickware virus, oran improperly operating software program.
 20. The computer-programproduct of claim 14, wherein the one or more agent actions correspondingto the low quality interactions are identified further based on adetermination that the agent is identifiable from a blacklist of networkaddresses.